From patchwork Fri Jul 22 22:18:07 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: HoP X-Patchwork-Id: 1001172 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.4) with ESMTP id p6MMIB2f020606 for ; Fri, 22 Jul 2011 22:18:11 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751709Ab1GVWSI (ORCPT ); Fri, 22 Jul 2011 18:18:08 -0400 Received: from mail-gy0-f174.google.com ([209.85.160.174]:65314 "EHLO mail-gy0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751599Ab1GVWSI (ORCPT ); Fri, 22 Jul 2011 18:18:08 -0400 Received: by gyh3 with SMTP id 3so1549101gyh.19 for ; Fri, 22 Jul 2011 15:18:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; bh=Qo1IpsgSqRPZ2RXAS5nQZ7QWNSdsyP1CJpHSE/QNNzA=; b=kvnq2sfa610Mp8G1MkEIPP/ZZkp079Er3pw1b0gbOoFSRp0KbG/pLy1JJk7A0mup3D mNfdXfjo+GQBe1M6BIQvSu5CnRsjeaJu7bCYFhXB++C2jFhYEjgjtJe7B7/WfMVYGKQt 1obzvLgBev43Vyu0qExw2lWP2bd7DqkBUDEWQ= MIME-Version: 1.0 Received: by 10.236.136.164 with SMTP id w24mr3242878yhi.171.1311373087017; Fri, 22 Jul 2011 15:18:07 -0700 (PDT) Received: by 10.236.136.97 with HTTP; Fri, 22 Jul 2011 15:18:07 -0700 (PDT) Date: Sat, 23 Jul 2011 00:18:07 +0200 Message-ID: Subject: [PATCH] cxd2820r: fix possible out-of-array lookup From: HoP To: linux-media@vger.kernel.org, Antti Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Fri, 22 Jul 2011 22:18:15 +0000 (UTC) In case of i2c write operation there is only one element in msg[] array. Don't access msg[1] in that case. Signed-off-by: Honza Petrous --- the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff -uBbp cxd2820r_core.c.orig cxd2820r_core.c --- cxd2820r_core.c.orig 2011-07-22 23:31:56.319168405 +0200 +++ cxd2820r_core.c 2011-07-22 23:35:02.508046078 +0200 @@ -750,8 +750,6 @@ static int cxd2820r_tuner_i2c_xfer(struc }, { .addr = priv->cfg.i2c_address, .flags = I2C_M_RD, - .len = msg[1].len, - .buf = msg[1].buf, } }; @@ -760,6 +758,8 @@ static int cxd2820r_tuner_i2c_xfer(struc if (num == 2) { /* I2C read */ obuf[1] = (msg[0].addr << 1) | I2C_M_RD; /* I2C RD flag */ msg2[0].len = sizeof(obuf) - 1; /* maybe HW bug ? */ + msg2[1].len = msg[1].len; + msg2[1].buf = msg[1].buf; } memcpy(&obuf[2], msg[0].buf, msg[0].len); -- To unsubscribe from this list: send the line "unsubscribe linux-media" in